{\rtf1\ansi\ansicpg936\deff0{\fonttbl{\f0\fnil\fcharset134 \'cb\'ce\'cc\'e5;}}
{\colortbl ;\red255\green0\blue0;\red255\green0\blue255;}
{\*\generator Msftedit 5.41.15.1515;}\viewkind4\uc1\pard\lang2052\f0\fs20 yb_mem.dll\par
python24.dll\par
msvcr71.dll //VC7\'d4\'cb\'d0\'d0\'bf\'e2\par
0012CCFC   1200AA63  c?\'12   /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 yb_mem.1200AA61\par
0012CD00   00000003  \'03...  |HookType = WH_GETMESSAGE\par
0012CD04   1200A600  .?\'12   |Hookproc = yb_mem.\cf1 1200A600\cf0\par
0012CD08   12000000  ...\'12  |hModule = 12000000 (yb_mem)\par
0012CD0C   00000000  ....  \\ThreadID = 0\par
0012CD10   00000000  ....\par
0012CD14   000D0000  ....\par
0012CD18   77D31923  #\'19\'d3\'77   \'b7\'b5\'bb\'d8\'b5\'bd USER32.77D31923\par
\par
0012CCFC   1200AA1E  \'1e?\'12   /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 yb_mem.1200AA1C\par
0012CD00   00000009  ....  |HookType = WH_DEBUG\par
0012CD04   1200A590  \'90\'a5.\'12   |Hookproc = yb_mem.1200A590\par
0012CD08   00000000  ....  |hModule = NULL\par
0012CD0C   00000340  @\'03..  \\ThreadID = 340\par
\par
\par
0012B208   08A7730E  \'0es?   /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 08A77309\par
0012B20C   00000002  \'02...  |HookType = WH_KEYBOARD\par
0012B210   08A765E0  \'e0\'65?    |Hookproc = 08A765E0\par
0012B214   00000000  ....  |hModule = NULL\par
0012B218   00000340  @\'03..  \\ThreadID = 340\par
\par
0012B580   08A5734E  Ns?   /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 08A57349\par
0012B584   00000002  \'02...  |HookType = WH_KEYBOARD\par
0012B588   08A56620   f?   |Hookproc = 08A56620\par
0012B58C   00000000  ....  |hModule = NULL\par
0012B590   00000340  @\'03..  \\ThreadID = 340\par
0012B8F8   0895719E  \'9e\'71?    /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 08957199\par
0012B8FC   00000002  \'02...  |HookType = WH_KEYBOARD\par
0012B900   08956470  pd?   |Hookproc = 08956470\par
0012B904   00000000  ....  |hModule = NULL\par
0012B908   00000340  @\'03..  \\ThreadID = 340\par
0012BC70   0897729E  \'9e\'72?    /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 08977299\par
0012BC74   00000002  \'02...  |HookType = WH_KEYBOARD\par
0012BC78   08976570  pe?   |Hookproc = 08976570\par
0012BC7C   00000000  ....  |hModule = NULL\par
0012BC80   00000340  @\'03..  \\ThreadID = 340\par
\par
0012C360   08B171BE  \'be\'71?    /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 08B171B9\par
0012C364   00000002  \'02...  |HookType = WH_KEYBOARD\par
0012C368   08B16490  \'90\'64?    |Hookproc = 08B16490\par
0012C36C   00000000  ....  |hModule = NULL\par
0012C370   00000340  @\'03..  \\ThreadID = 340\par
0012C6D8   08B9724E  Nr?   /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 08B97249\par
0012C6DC   00000002  \'02...  |HookType = WH_KEYBOARD\par
0012C6E0   08B96520   e?   |Hookproc = 08B96520\par
0012C6E4   00000000  ....  |hModule = NULL\par
0012C6E8   00000340  @\'03..  \\ThreadID = 340\par
0012B208   08A7730E  \'0es?   /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 08A77309\par
0012B20C   00000002  \'02...  |HookType = WH_KEYBOARD\par
0012B210   08A765E0  \'e0\'65?    |Hookproc = 08A765E0\par
0012B214   00000000  ....  |hModule = NULL\par
0012B218   00000340  @\'03..  \\ThreadID = 340\par
\par
\par
//////\'c3\'dc\'c2\'eb\'bf\'f2\'ca\'b1\par
\par
0012CAB8   1200AB05  \'05?\'12   /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 yb_mem.1200AB03\par
0012CABC   00000009  ....  |HookType = WH_DEBUG\par
0012CAC0   1200A590  \'90\'a5.\'12   |Hookproc = yb_mem.1200A590\par
0012CAC4   00000000  ....  |hModule = NULL\par
0012CAC8   0000096C  l...  \\ThreadID = 96C\par
0012CACC   00000001  \'01...\par
\par
\par
\par
0012CAB8   1200AB59  Y?\'12   /CALL \'b5\'bd SetWindowsHookExA \'c0\'b4\'d7\'d4 yb_mem.1200AB57\par
0012CABC   0000000D  ....  |HookType = 13.\par
0012CAC0   1200A9A0  \'a0\'a9.\'12   |Hookproc = \cf2 yb_mem.1200A9A0\cf0\par
0012CAC4   12000000  ...\'12  |hModule = 12000000 (yb_mem)\par
0012CAC8   00000000  ....  \\ThreadID = 0\par
//yb_membase=0x12001000\par
//yb_mem.dll\'c0\'ef\'b1\'df yb_membase+0x99A0\par
[esp+c]\par
\cf2 1200A9A0   \cf0 .  8B4424 04     MOV EAX,DWORD PTR SS:[ESP+4]             ;  \'c3\'dc\'c2\'eb\'b1\'a3\'bb\'a4\par
1200A9A4   .  85C0          TEST EAX,EAX\par
1200A9A6   .  7D 1A         JGE SHORT yb_mem.\cf1 1200A9C2\cf0\par
1200A9A8   .  8B4C24 0C     MOV ECX,DWORD PTR SS:[ESP+C]\par
1200A9AC   .  8B5424 08     MOV EDX,DWORD PTR SS:[ESP+8]\par
1200A9B0   .  51            PUSH ECX                                 ; /lParam\par
1200A9B1   .  52            PUSH EDX                                 ; |wParam\par
1200A9B2   .  50            PUSH EAX                                 ; |HookCode\par
1200A9B3   .  A1 D08C0212   MOV EAX,DWORD PTR DS:[12028CD0]          ; |\par
1200A9B8   .  50            PUSH EAX                                 ; |hHook => NULL\par
1200A9B9   .  FF15 60C10112 CALL DWORD PTR DS:[<&USER32.CallNextHook>; \\CallNextHookEx\par
1200A9BF   .  C2 0C00       RETN 0C\par
\cf1 1200A9C2   \cf0 >  833D 48110212>CMP DWORD PTR DS:[12021148],0\par
1200A9C9   .  0F84 9B000000 JE yb_mem.\cf1 1200AA6A\cf0\par
1200A9CF   .  A1 D08C0212   MOV EAX,DWORD PTR DS:[12028CD0]\par
1200A9D4   .  85C0          TEST EAX,EAX\par
1200A9D6   .  56            PUSH ESI\par
1200A9D7   .  57            PUSH EDI\par
1200A9D8   .  8B3D 68C10112 MOV EDI,DWORD PTR DS:[<&USER32.UnhookWin>;  USER32.UnhookWindowsHookEx\par
1200A9DE   .  74 03         JE SHORT yb_mem.\cf1 1200A9E3\cf0\par
1200A9E0   .  50            PUSH EAX                                 ; /hHook => NULL\par
1200A9E1   .  FFD7          CALL EDI                                 ; \\UnhookWindowsHookEx\par
1200A9E3   >  8B0D 6C8C0212 MOV ECX,DWORD PTR DS:[12028C6C]          ;  yb_mem.12000000\par
1200A9E9   .  8B35 5CC10112 MOV ESI,DWORD PTR DS:[<&USER32.SetWindow>;  USER32.SetWindowsHookExA\par
1200A9EF   .  6A 00         PUSH 0                                   ; /ThreadID = 0\par
1200A9F1   .  51            PUSH ECX                                 ; |hModule => 12000000 (yb_mem)\par
1200A9F2   .  68 A0A90012   PUSH yb_mem.1200A9A0                     ; |Hookproc = yb_mem.1200A9A0\par
1200A9F7   .  6A 0D         PUSH 0D                                  ; |HookType = 13.\par
1200A9F9   .  FFD6          CALL ESI                                 ; \\SetWindowsHookExA\par
1200A9FB   .  A3 D08C0212   MOV DWORD PTR DS:[12028CD0],EAX\par
1200AA00   .  A1 C08C0212   MOV EAX,DWORD PTR DS:[12028CC0]\par
1200AA05   .  85C0          TEST EAX,EAX\par
1200AA07   .  74 03         JE SHORT yb_mem.1200AA0C\par
1200AA09   .  50            PUSH EAX\par
1200AA0A   .  FFD7          CALL EDI //UnhookWindowsHookEx\par
1200AA0C   >  8B15 688C0212 MOV EDX,DWORD PTR DS:[12028C68]\par
1200AA12   .  52            PUSH EDX\par
1200AA13   .  6A 00         PUSH 0\par
1200AA15   .  68 90A50012   PUSH yb_mem.1200A590\par
1200AA1A   .  6A 09         PUSH 9\par
1200AA1C   .  FFD6          CALL ESI  //SetWindowsHookExA\par
1200AA1E   .  A3 C08C0212   MOV DWORD PTR DS:[12028CC0],EAX\par
1200AA23   .  A1 C48C0212   MOV EAX,DWORD PTR DS:[12028CC4]\par
1200AA28   .  85C0          TEST EAX,EAX\par
1200AA2A   .  74 03         JE SHORT yb_mem.1200AA2F\par
1200AA2C   .  50            PUSH EAX\par
1200AA2D   .  FFD7          CALL EDI //UnhookWindowsHookEx\par
\par
1200AA2F   >  A1 6C8C0212   MOV EAX,DWORD PTR DS:[12028C6C]\par
1200AA34   .  6A 00         PUSH 0\par
1200AA36   .  50            PUSH EAX\par
1200AA37   .  68 90A50012   PUSH yb_mem.1200A590\par
1200AA3C   .  6A 09         PUSH 9\par
1200AA3E   .  FFD6          CALL ESI //SetWindowsHookExA\par
1200AA40   .  A3 C48C0212   MOV DWORD PTR DS:[12028CC4],EAX\par
1200AA45   .  A1 D48C0212   MOV EAX,DWORD PTR DS:[12028CD4]\par
1200AA4A   .  85C0          TEST EAX,EAX\par
1200AA4C   .  74 03         JE SHORT yb_mem.1200AA51\par
1200AA4E   .  50            PUSH EAX\par
1200AA4F   .  FFD7          CALL EDI//UnhookWindowsHookEx\par
\par
1200AA51   >  8B0D 6C8C0212 MOV ECX,DWORD PTR DS:[12028C6C]          ;  yb_mem.12000000\par
1200AA57   .  6A 00         PUSH 0\par
1200AA59   .  51            PUSH ECX\par
1200AA5A   .  68 00A60012   PUSH yb_mem.1200A600\par
1200AA5F   .  6A 03         PUSH 3\par
1200AA61   .  FFD6          CALL ESI// \\SetWindowsHookExA\par
1200AA63   .  5F            POP EDI\par
1200AA64   .  A3 D48C0212   MOV DWORD PTR DS:[12028CD4],EAX\par
1200AA69   .  5E            POP ESI\par
\cf1 1200AA6A   \cf0 >  33C0          XOR EAX,EAX\par
1200AA6C   .  C2 0C00       RETN 0C\par
\par
\par
\par
\par
\par
1200A99E      CC            INT3\par
1200A99F      CC            INT3\par
1200A9A0   .  8B4424 04     MOV EAX,DWORD PTR SS:[ESP+4]             ;  \'c3\'dc\'c2\'eb\'b1\'a3\'bb\'a4\par
1200A9A4   .  85C0          TEST EAX,EAX\par
1200A9A6   .  7D 1A         JGE SHORT yb_mem.1200A9C2\par
1200A9A8   .  8B4C24 0C     MOV ECX,DWORD PTR SS:[ESP+C]\par
1200A9AC   .  8B5424 08     MOV EDX,DWORD PTR SS:[ESP+8]\par
1200A9B0   .  51            PUSH ECX                                 ; /lParam\par
1200A9B1   .  52            PUSH EDX                                 ; |wParam\par
1200A9B2   .  50            PUSH EAX                                 ; |HookCode\par
1200A9B3   .  A1 D08C0212   MOV EAX,DWORD PTR DS:[12028CD0]          ; |\par
1200A9B8   .  50            PUSH EAX                                 ; |hHook => NULL\par
1200A9B9   .  FF15 60C10112 CALL DWORD PTR DS:[<&USER32.CallNextHook>; \\CallNextHookEx\par
1200A9BF   .  C2 0C00       RETN 0C\par
1200A9C2   >  833D 48110212>CMP DWORD PTR DS:[12021148],0\par
1200A9C9   .  0F84 9B000000 JE yb_mem.1200AA6A\par
1200A9CF   .  A1 D08C0212   MOV EAX,DWORD PTR DS:[12028CD0]\par
1200A9D4   .  85C0          TEST EAX,EAX\par
1200A9D6   .  56            PUSH ESI\par
1200A9D7   .  57            PUSH EDI\par
1200A9D8   .  8B3D 68C10112 MOV EDI,DWORD PTR DS:[<&USER32.UnhookWin>;  USER32.UnhookWindowsHookEx\par
1200A9DE   .  74 03         JE SHORT yb_mem.1200A9E3\par
1200A9E0   .  50            PUSH EAX                                 ; /hHook => NULL\par
1200A9E1   .  FFD7          CALL EDI                                 ; \\UnhookWindowsHookEx\par
1200A9E3   >  8B0D 6C8C0212 MOV ECX,DWORD PTR DS:[12028C6C]          ;  yb_mem.12000000\par
1200A9E9   .  8B35 5CC10112 MOV ESI,DWORD PTR DS:[<&USER32.SetWindow>;  USER32.SetWindowsHookExA\par
1200A9EF   .  6A 00         PUSH 0                                   ; /ThreadID = 0\par
1200A9F1   .  51            PUSH ECX                                 ; |hModule => 12000000 (yb_mem)\par
1200A9F2   .  68 A0A90012   PUSH yb_mem.1200A9A0                     ; |Hookproc = yb_mem.1200A9A0\par
1200A9F7   .  6A 0D         PUSH 0D                                  ; |HookType = 13.\par
1200A9F9   .  FFD6          CALL ESI                                 ; \\SetWindowsHookExA\par
1200A9FB   .  A3 D08C0212   MOV DWORD PTR DS:[12028CD0],EAX\par
1200AA00   .  A1 C08C0212   MOV EAX,DWORD PTR DS:[12028CC0]\par
1200AA05   .  85C0          TEST EAX,EAX\par
1200AA07   .  74 03         JE SHORT yb_mem.1200AA0C\par
1200AA09   .  50            PUSH EAX\par
1200AA0A   .  FFD7          CALL EDI\par
1200AA0C   >  8B15 688C0212 MOV EDX,DWORD PTR DS:[12028C68]\par
1200AA12   .  52            PUSH EDX\par
1200AA13   .  6A 00         PUSH 0\par
1200AA15   .  68 90A50012   PUSH yb_mem.1200A590\par
1200AA1A   .  6A 09         PUSH 9\par
1200AA1C   .  FFD6          CALL ESI\par
1200AA1E   .  A3 C08C0212   MOV DWORD PTR DS:[12028CC0],EAX\par
1200AA23   .  A1 C48C0212   MOV EAX,DWORD PTR DS:[12028CC4]\par
1200AA28   .  85C0          TEST EAX,EAX\par
1200AA2A   .  74 03         JE SHORT yb_mem.1200AA2F\par
1200AA2C   .  50            PUSH EAX\par
1200AA2D   .  FFD7          CALL EDI\par
1200AA2F   >  A1 6C8C0212   MOV EAX,DWORD PTR DS:[12028C6C]\par
1200AA34   .  6A 00         PUSH 0\par
1200AA36   .  50            PUSH EAX\par
1200AA37   .  68 90A50012   PUSH yb_mem.1200A590\par
1200AA3C   .  6A 09         PUSH 9\par
1200AA3E   .  FFD6          CALL ESI\par
1200AA40   .  A3 C48C0212   MOV DWORD PTR DS:[12028CC4],EAX\par
1200AA45   .  A1 D48C0212   MOV EAX,DWORD PTR DS:[12028CD4]\par
1200AA4A   .  85C0          TEST EAX,EAX\par
1200AA4C   .  74 03         JE SHORT yb_mem.1200AA51\par
1200AA4E   .  50            PUSH EAX\par
1200AA4F   .  FFD7          CALL EDI\par
1200AA51   >  8B0D 6C8C0212 MOV ECX,DWORD PTR DS:[12028C6C]          ;  yb_mem.12000000\par
1200AA57   .  6A 00         PUSH 0\par
1200AA59   .  51            PUSH ECX\par
1200AA5A   .  68 00A60012   PUSH yb_mem.1200A600\par
1200AA5F   .  6A 03         PUSH 3\par
1200AA61   .  FFD6          CALL ESI\par
1200AA63   .  5F            POP EDI\par
1200AA64   .  A3 D48C0212   MOV DWORD PTR DS:[12028CD4],EAX\par
1200AA69   .  5E            POP ESI\par
1200AA6A   >  33C0          XOR EAX,EAX\par
1200AA6C   .  C2 0C00       RETN 0C\par
1200AA6F      CC            INT3\par
1200AA70 >/$  51            PUSH ECX\par
1200AA71  |.  A1 10120212   MOV EAX,DWORD PTR DS:[12021210]\par
1200AA76  |.  33C4          XOR EAX,ESP\par
1200AA78  |.  890424        MOV DWORD PTR SS:[ESP],EAX\par
1200AA7B  |.  8B0C24        MOV ECX,DWORD PTR SS:[ESP]\par
1200AA7E  |.  33CC          XOR ECX,ESP\par
1200AA80  |.  33C0          XOR EAX,EAX\par
1200AA82  |.  E8 75120000   CALL yb_mem.1200BCFC\par
1200AA87  |.  59            POP ECX\par
1200AA88  \\.  C2 1000       RETN 10\par
1200AA8B      CC            INT3\par
1200AA8C      CC            INT3\par
1200AA8D      CC            INT3\par
1200AA8E      CC            INT3\par
1200AA8F      CC            INT3\par
1200AA90 >/$  68 FCCA0112   PUSH yb_mem.1201CAFC                     ; /Title = "YB_OnlineClient"\par
1200AA95  |.  68 F0CA0112   PUSH yb_mem.1201CAF0                     ; |Class = "D3D Window"\par
1200AA9A  |.  FF15 6CC10112 CALL DWORD PTR DS:[<&USER32.FindWindowA>>; \\FindWindowA\par
1200AAA0  |.  85C0          TEST EAX,EAX\par
1200AAA2  |.  6A 00         PUSH 0                                   ; /ExitCode = 0\par
1200AAA4  |.  75 06         JNZ SHORT yb_mem.1200AAAC                ; |\par
1200AAA6  |.  FF15 94C00112 CALL DWORD PTR DS:[<&KERNEL32.ExitProces>; \\ExitProcess\par
1200AAAC  |>  6A 00         PUSH 0                                   ; |wParam = 0\par
1200AAAE  |.  68 B0080000   PUSH 8B0                                 ; |Message = MSG(8B0)\par
1200AAB3  |.  50            PUSH EAX                                 ; |hWnd\par
1200AAB4  |.  FF15 64C10112 CALL DWORD PTR DS:[<&USER32.SendMessageA>; \\SendMessageA\par
1200AABA  |.  803D 748C0212>CMP BYTE PTR DS:[12028C74],0\par
1200AAC1  |.  75 06         JNZ SHORT yb_mem.1200AAC9\par
1200AAC3  |.  83C8 FF       OR EAX,FFFFFFFF\par
1200AAC6  |.  C2 0400       RETN 4\par
1200AAC9  |>  8B4424 04     MOV EAX,DWORD PTR SS:[ESP+4]\par
1200AACD  |.  85C0          TEST EAX,EAX\par
1200AACF  |.  75 08         JNZ SHORT yb_mem.1200AAD9\par
1200AAD1  |.  B8 FEFFFFFF   MOV EAX,-2\par
1200AAD6  |.  C2 0400       RETN 4\par
1200AAD9  |>  56            PUSH ESI\par
1200AADA  |.  A3 648C0212   MOV DWORD PTR DS:[12028C64],EAX\par
1200AADF  |.  FF15 A0C00112 CALL DWORD PTR DS:[<&KERNEL32.GetCurrent>; [GetCurrentThreadId\par
1200AAE5  |.  833D C08C0212>CMP DWORD PTR DS:[12028CC0],0\par
1200AAEC  |.  8B35 5CC10112 MOV ESI,DWORD PTR DS:[<&USER32.SetWindow>;  USER32.SetWindowsHookExA\par
1200AAF2  |.  A3 688C0212   MOV DWORD PTR DS:[12028C68],EAX\par
1200AAF7  |.  75 11         JNZ SHORT yb_mem.1200AB0A\par
1200AAF9  |.  50            PUSH EAX                                 ; /ThreadID\par
1200AAFA  |.  6A 00         PUSH 0                                   ; |hModule = NULL\par
1200AAFC  |.  68 90A50012   PUSH yb_mem.1200A590                     ; |Hookproc = yb_mem.1200A590\par
1200AB01  |.  6A 09         PUSH 9                                   ; |HookType = WH_DEBUG\par
1200AB03  |.  FFD6          CALL ESI                                 ; \\SetWindowsHookExA\par
1200AB05  |.  A3 C08C0212   MOV DWORD PTR DS:[12028CC0],EAX\par
1200AB0A  |>  A1 C48C0212   MOV EAX,DWORD PTR DS:[12028CC4]\par
1200AB0F  |.  85C0          TEST EAX,EAX\par
1200AB11  |.  75 15         JNZ SHORT yb_mem.1200AB28\par
1200AB13  |.  50            PUSH EAX\par
1200AB14  |.  A1 6C8C0212   MOV EAX,DWORD PTR DS:[12028C6C]\par
1200AB19  |.  50            PUSH EAX\par
1200AB1A  |.  68 90A50012   PUSH yb_mem.1200A590\par
\par
\par
\par
1200A9A0   .  8B4424 04     MOV EAX,DWORD PTR SS:[ESP+4]                     ;  \'c3\'dc\'c2\'eb\'b1\'a3\'bb\'a4\par
1200A9A4   .  85C0          TEST EAX,EAX\par
1200A9A6   .  7D 1A         JGE SHORT yb_mem.1200A9C2\par
1200A9A8   .  8B4C24 0C     MOV ECX,DWORD PTR SS:[ESP+C]\par
1200A9AC   .  8B5424 08     MOV EDX,DWORD PTR SS:[ESP+8]\par
1200A9B0   .  51            PUSH ECX                                         ; /lParam\par
1200A9B1   .  52            PUSH EDX                                         ; |wParam\par
1200A9B2   .  50            PUSH EAX                                         ; |HookCode\par
1200A9B3   .  A1 D08C0212   MOV EAX,DWORD PTR DS:[12028CD0]                  ; |\par
1200A9B8   .  50            PUSH EAX                                         ; |hHook => 00071113\par
1200A9B9   .  FF15 60C10112 CALL DWORD PTR DS:[<&USER32.CallNextHookEx>]     ; \\CallNextHookEx\par
1200A9BF   .  C2 0C00       RETN 0C\par
1200A9C2   >  833D 48110212>CMP DWORD PTR DS:[12021148],0\par
1200A9C9   .  0F84 9B000000 JE yb_mem.1200AA6A\par
1200A9CF   .  A1 D08C0212   MOV EAX,DWORD PTR DS:[12028CD0]\par
1200A9D4   .  85C0          TEST EAX,EAX\par
1200A9D6   .  56            PUSH ESI\par
1200A9D7   .  57            PUSH EDI\par
1200A9D8   .  8B3D 68C10112 MOV EDI,DWORD PTR DS:[<&USER32.UnhookWindowsHook>;  USER32.UnhookWindowsHookEx\par
1200A9DE   .  74 03         JE SHORT yb_mem.1200A9E3\par
1200A9E0   .  50            PUSH EAX                                         ; /hHook => 00071113\par
1200A9E1   .  FFD7          CALL EDI                                         ; \\UnhookWindowsHookEx\par
1200A9E3   >  8B0D 6C8C0212 MOV ECX,DWORD PTR DS:[12028C6C]                  ;  yb_mem.12000000\par
1200A9E9   .  8B35 5CC10112 MOV ESI,DWORD PTR DS:[<&USER32.SetWindowsHookExA>;  USER32.SetWindowsHookExA\par
1200A9EF   .  6A 00         PUSH 0                                           ; /ThreadID = 0\par
1200A9F1   .  51            PUSH ECX                                         ; |hModule => 12000000 (yb_mem)\par
1200A9F2   .  68 A0A90012   PUSH yb_mem.1200A9A0                             ; |Hookproc = yb_mem.1200A9A0\par
1200A9F7   .  6A 0D         PUSH 0D                                          ; |HookType = 13.\par
1200A9F9   .  FFD6          CALL ESI                                         ; \\SetWindowsHookExA\par
1200A9FB   .  A3 D08C0212   MOV DWORD PTR DS:[12028CD0],EAX\par
1200AA00   .  A1 C08C0212   MOV EAX,DWORD PTR DS:[12028CC0]\par
1200AA05   .  85C0          TEST EAX,EAX\par
1200AA07   .  74 03         JE SHORT yb_mem.1200AA0C\par
1200AA09   .  50            PUSH EAX\par
1200AA0A   .  FFD7          CALL EDI\par
1200AA0C   >  8B15 688C0212 MOV EDX,DWORD PTR DS:[12028C68]\par
1200AA12   .  52            PUSH EDX\par
1200AA13   .  6A 00         PUSH 0\par
1200AA15   .  68 90A50012   PUSH yb_mem.1200A590\par
1200AA1A   .  6A 09         PUSH 9\par
1200AA1C   .  FFD6          CALL ESI\par
1200AA1E   .  A3 C08C0212   MOV DWORD PTR DS:[12028CC0],EAX\par
1200AA23   .  A1 C48C0212   MOV EAX,DWORD PTR DS:[12028CC4]\par
1200AA28   .  85C0          TEST EAX,EAX\par
1200AA2A   .  74 03         JE SHORT yb_mem.1200AA2F\par
1200AA2C   .  50            PUSH EAX\par
1200AA2D   .  FFD7          CALL EDI\par
1200AA2F   >  A1 6C8C0212   MOV EAX,DWORD PTR DS:[12028C6C]\par
1200AA34   .  6A 00         PUSH 0\par
1200AA36   .  50            PUSH EAX\par
1200AA37   .  68 90A50012   PUSH yb_mem.1200A590\par
1200AA3C   .  6A 09         PUSH 9\par
1200AA3E   .  FFD6          CALL ESI\par
1200AA40   .  A3 C48C0212   MOV DWORD PTR DS:[12028CC4],EAX\par
1200AA45   .  A1 D48C0212   MOV EAX,DWORD PTR DS:[12028CD4]\par
1200AA4A   .  85C0          TEST EAX,EAX\par
1200AA4C   .  74 03         JE SHORT yb_mem.1200AA51\par
1200AA4E   .  50            PUSH EAX\par
1200AA4F   .  FFD7          CALL EDI\par
1200AA51   >  8B0D 6C8C0212 MOV ECX,DWORD PTR DS:[12028C6C]                  ;  yb_mem.12000000\par
1200AA57   .  6A 00         PUSH 0\par
1200AA59   .  51            PUSH ECX\par
1200AA5A   .  68 00A60012   PUSH yb_mem.1200A600\par
1200AA5F   .  6A 03         PUSH 3\par
1200AA61   .  FFD6          CALL ESI\par
1200AA63   .  5F            POP EDI\par
1200AA64   .  A3 D48C0212   MOV DWORD PTR DS:[12028CD4],EAX\par
1200AA69   .  5E            POP ESI\par
1200AA6A   >  33C0          XOR EAX,EAX\par
1200AA6C   .  C2 0C00       RETN 0C\par
1200AA6F      CC            INT3\par
1200AA70 >/$  51            PUSH ECX\par
1200AA71  |.  A1 10120212   MOV EAX,DWORD PTR DS:[12021210]\par
1200AA76  |.  33C4          XOR EAX,ESP\par
1200AA78  |.  890424        MOV DWORD PTR SS:[ESP],EAX\par
1200AA7B  |.  8B0C24        MOV ECX,DWORD PTR SS:[ESP]\par
1200AA7E  |.  33CC          XOR ECX,ESP\par
1200AA80  |.  33C0          XOR EAX,EAX\par
1200AA82  |.  E8 75120000   CALL yb_mem.1200BCFC\par
1200AA87  |.  59            POP ECX\par
1200AA88  \\.  C2 1000       RETN 10\par
1200AA8B      CC            INT3\par
1200AA8C      CC            INT3\par
1200AA8D      CC            INT3\par
1200AA8E      CC            INT3\par
1200AA8F      CC            INT3\par
1200AA90 >/$  68 FCCA0112   PUSH yb_mem.1201CAFC                             ; /Title = "YB_OnlineClient"\par
1200AA95  |.  68 F0CA0112   PUSH yb_mem.1201CAF0                             ; |Class = "D3D Window"\par
1200AA9A  |.  FF15 6CC10112 CALL DWORD PTR DS:[<&USER32.FindWindowA>]        ; \\FindWindowA\par
1200AAA0  |.  85C0          TEST EAX,EAX\par
1200AAA2  |.  6A 00         PUSH 0                                           ; /ExitCode = 0\par
1200AAA4  |.  75 06         JNZ SHORT yb_mem.1200AAAC                        ; |\par
1200AAA6  |.  FF15 94C00112 CALL DWORD PTR DS:[<&KERNEL32.ExitProcess>]      ; \\ExitProcess\par
1200AAAC  |>  6A 00         PUSH 0                                           ; |wParam = 0\par
1200AAAE  |.  68 B0080000   PUSH 8B0                                         ; |Message = MSG(8B0)\par
1200AAB3  |.  50            PUSH EAX                                         ; |hWnd\par
1200AAB4  |.  FF15 64C10112 CALL DWORD PTR DS:[<&USER32.SendMessageA>]       ; \\SendMessageA\par
1200AABA  |.  803D 748C0212>CMP BYTE PTR DS:[12028C74],0\par
1200AAC1  |.  75 06         JNZ SHORT yb_mem.1200AAC9\par
1200AAC3  |.  83C8 FF       OR EAX,FFFFFFFF\par
1200AAC6  |.  C2 0400       RETN 4\par
1200AAC9  |>  8B4424 04     MOV EAX,DWORD PTR SS:[ESP+4]\par
1200AACD  |.  85C0          TEST EAX,EAX\par
1200AACF  |.  75 08         JNZ SHORT yb_mem.1200AAD9\par
1200AAD1  |.  B8 FEFFFFFF   MOV EAX,-2\par
1200AAD6  |.  C2 0400       RETN 4\par
1200AAD9  |>  56            PUSH ESI\par
1200AADA  |.  A3 648C0212   MOV DWORD PTR DS:[12028C64],EAX\par
1200AADF  |.  FF15 A0C00112 CALL DWORD PTR DS:[<&KERNEL32.GetCurrentThreadId>; [GetCurrentThreadId\par
1200AAE5  |.  833D C08C0212>CMP DWORD PTR DS:[12028CC0],0\par
1200AAEC  |.  8B35 5CC10112 MOV ESI,DWORD PTR DS:[<&USER32.SetWindowsHookExA>;  USER32.SetWindowsHookExA\par
1200AAF2  |.  A3 688C0212   MOV DWORD PTR DS:[12028C68],EAX\par
1200AAF7  |.  75 11         JNZ SHORT yb_mem.1200AB0A\par
1200AAF9  |.  50            PUSH EAX                                         ; /ThreadID\par
1200AAFA  |.  6A 00         PUSH 0                                           ; |hModule = NULL\par
1200AAFC  |.  68 90A50012   PUSH yb_mem.1200A590                             ; |Hookproc = yb_mem.1200A590\par
1200AB01  |.  6A 09         PUSH 9                                           ; |HookType = WH_DEBUG\par
1200AB03  |.  FFD6          CALL ESI                                         ; \\SetWindowsHookExA\par
1200AB05  |.  A3 C08C0212   MOV DWORD PTR DS:[12028CC0],EAX\par
1200AB0A  |>  A1 C48C0212   MOV EAX,DWORD PTR DS:[12028CC4]\par
1200AB0F  |.  85C0          TEST EAX,EAX\par
1200AB11  |.  75 15         JNZ SHORT yb_mem.1200AB28\par
1200AB13  |.  50            PUSH EAX\par
1200AB14  |.  A1 6C8C0212   MOV EAX,DWORD PTR DS:[12028C6C]\par
1200AB19  |.  50            PUSH EAX\par
1200AB1A  |.  68 90A50012   PUSH yb_mem.1200A590\par
1200AB1F  |.  6A 09         PUSH 9\par
1200AB21  |.  FFD6          CALL ESI\par
1200AB23  |.  A3 C48C0212   MOV DWORD PTR DS:[12028CC4],EAX\par
1200AB28  |>  833D C08C0212>CMP DWORD PTR DS:[12028CC0],0\par
1200AB2F  |.  74 77         JE SHORT yb_mem.1200ABA8\par
1200AB31  |.  85C0          TEST EAX,EAX\par
1200AB33  |.  74 73         JE SHORT yb_mem.1200ABA8\par
1200AB35  |.  833D 48110212>CMP DWORD PTR DS:[12021148],0\par
1200AB3C  |.  74 32         JE SHORT yb_mem.1200AB70\par
1200AB3E  |.  833D D08C0212>CMP DWORD PTR DS:[12028CD0],0\par
1200AB45  |.  75 29         JNZ SHORT yb_mem.1200AB70\par
1200AB47  |.  8B0D 6C8C0212 MOV ECX,DWORD PTR DS:[12028C6C]                  ;  yb_mem.12000000\par
1200AB4D  |.  6A 00         PUSH 0\par
1200AB4F  |.  51            PUSH ECX\par
1200AB50  |.  68 A0A90012   PUSH yb_mem.1200A9A0\par
1200AB55  |.  6A 0D         PUSH 0D\par
1200AB57  |.  FFD6          CALL ESI\par
1200AB59  |.  85C0          TEST EAX,EAX\par
1200AB5B  |.  A3 D08C0212   MOV DWORD PTR DS:[12028CD0],EAX\par
1200AB60  |.  75 0E         JNZ SHORT yb_mem.1200AB70\par
1200AB62  |.  E8 B9F8FFFF   CALL yb_mem.ProtectStop\par
1200AB67  |.  B8 FCFFFFFF   MOV EAX,-4\par
1200AB6C  |.  5E            POP ESI\par
1200AB6D  |.  C2 0400       RETN 4\par
1200AB70  |>  833D C88C0212>CMP DWORD PTR DS:[12028CC8],0\par
1200AB77  |.  75 29         JNZ SHORT yb_mem.1200ABA2\par
1200AB79  |.  8B15 688C0212 MOV EDX,DWORD PTR DS:[12028C68]\par
1200AB7F  |.  52            PUSH EDX\par
1200AB80  |.  6A 00         PUSH 0\par
1200AB82  |.  68 B0A60012   PUSH yb_mem.1200A6B0\par
1200AB87  |.  6A 07         PUSH 7\par
1200AB89  |.  FFD6          CALL ESI\par
1200AB8B  |.  85C0          TEST EAX,EAX\par
1200AB8D  |.  A3 C88C0212   MOV DWORD PTR DS:[12028CC8],EAX\par
1200AB92  |.  75 0E         JNZ SHORT yb_mem.1200ABA2\par
1200AB94  |.  E8 87F8FFFF   CALL yb_mem.ProtectStop\par
1200AB99  |.  B8 FBFFFFFF   MOV EAX,-5\par
1200AB9E  |.  5E            POP ESI\par
1200AB9F  |.  C2 0400       RETN 4\par
1200ABA2  |>  33C0          XOR EAX,EAX\par
1200ABA4  |.  5E            POP ESI\par
1200ABA5  |.  C2 0400       RETN 4\par
1200ABA8  |>  B8 FDFFFFFF   MOV EAX,-3\par
1200ABAD  |.  5E            POP ESI\par
1200ABAE  \\.  C2 0400       RETN 4\par
1200ABB1      CC            INT3\par
\par
\par
\par
\par
}
 